Azure Stack

Reports

• Azure Stack - User Logon and Logoff: This report provides information about the user logon and logoff.
• Azure stack - Directory permission change- This alert will be generated when directory permissions are changed.

Alerts

• Azure stack - Active Directory: Group policy changed - This alert will be generated when a group policy is changed.
• Azure stack - System shutdown - This alert will be generated when the system is shutdown.

Reports

• Azure Stack - Registry Changed: This report provides information about the registry changes done by the user.
• Azure Stack - Administration Activities: This report provides information about the administrative activities.
• Azure stack - Security: User account locked out - This alert will be generated when a user account is locked out.
• Azure stack - Security: Users added to Domain Admin or local Admin group - This alert will be generated when user is added to domain admin or local admin group.

Alerts

• Azure stack - Group policy processing error- This alert will be generated when an error occurs while processing a group policy.
• Azure stack - File replication service staging area full - This alert will be generated when the file replication service staging area is full.

Reports

• Azure Stack - User Logon Failed: This report provides information about the logon failures by users.
• Azure Stack - User Account Locked Out: This report provides information about user account locked out.
• Azure Stack - Audit Logs Cleared: This report provides information about the audit logs cleared also provides information about the user that cleared the audit logs.

Alerts

• Azure stack - *Security: User account unlocked - This alert will be generated when a user account is unlocked.
• Azure stack - Admin Interactive/Remote Interactive login failure - This alert will be generated when admin Interactive/Remote Interactive login failure occurs.
• Azure stack - Admin Interactive/Remote Interactive login success - This alert will be generated when admin Interactive/Remote Interactive login is successful.
• Azure stack - Administrative logon failure - This alert will be generated when an administrative logon failure occurs.
• Azure stack - Administrative logon success - This alert will be generated when administrative logon is successful.
• Azure stack - Audit event records discarded - This alert will be generated when audit event records are discarded.
• Azure stack - Audit log cleared - This alert will be generated when audit logs are cleared.                 
• Azure stack - Domain policy changes - This alert will be generated when domain policies are changed.
• Azure stack - Excessive access failures by a user - This alert will be generated when failure for excessive access occurs by a user.
• Azure stack - Excessive access failures in your organization - This alert will be generated when failure for excessive access occurs in your organization.
• Azure stack - Excessive access failures on a specific computer - This alert will be generated when failure for excessive access occurs on a specific computer.
• Azure stack - Excessive file deletes on a computer - This alert will be generated when excessive file is deleted on a computer.
• Azure stack - Excessive logon attempts from a IP address - This alert will be generated when excessive login attempts from a IP address.
• Azure stack - Excessive logon failures due to bad password/username - This alert will be generated when an excessive logon failure occurs due to bad password.
• Azure stack - Excessive logon failures in your enterprise - This alert will be generated when excessive logon failures occurs in your enterprise.
• Azure stack - Excessive logon failures in your enterprise due to user account locked - This alert will be generated when excessive logon failures occurs in your enterprise due to user account locked.
• Azure stack - Excessive user lockout in your enterprise - This alert will be generated when excessive user lockout occurs in your enterprise.
• Azure stack - Possible malware lateral movement - This alert will be generated when a possible malware lateral movement is suspected.                        
• Azure stack - Security: Users password set to never expire - This alert will be generated when user password is set to never expire.